Identifying Long Connections with Bro/Zeek

DNS Backdoors?